CVE-2024-54031: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-54031 affects the Linux kernel's netfilter component, specifically related to an unaligned atomic read issue in the nft_set_hash functionality. The vulnerability was discovered and disclosed on January 15, 2025, affecting the struct nft_set_ext implementation in the netfilter subsystem (NVD).

The vulnerability stems from an unaligned atomic read access to the genmask field in struct nft_set_ext, which can result in alignment faults on certain architectures. The issue manifests when accessing the genmask field, causing kernel paging requests to fail with an alignment fault (ESR = 0x0000000096000021). The problem occurs specifically in the nft_rhash_gc function within the nf_tables module (Kernel Commit).

When triggered, this vulnerability can cause a kernel panic due to an unaligned memory access, leading to a system crash. This primarily affects systems using the netfilter subsystem with nftables hash sets. The issue increases the size of elements for rhash and pipapo by 8 bytes on x86_64 architectures (Kernel Commit).

The vulnerability is triggered during normal operation of the netfilter subsystem, specifically in the garbage collection process of hash sets. It has been observed in kernel version 6.13.0-rc3+ and potentially affects other versions that use the nft_set_hash functionality (NVD).

The issue has been fixed by aligning the struct nft_set_ext to word size using the __aligned(BITS_PER_LONG / 8) attribute. This fix has been incorporated into various Linux kernel versions, including 5.10.234-1 and 6.1.128-1~deb11u1 for Debian systems (Debian LTS).